CVE-2026-125204: FFmpeg through 9.0.2 Heap Buffer Overflow in libwebp Encoder Conditional Replenishment

FFmpeg through 9.0.2 contains a heap buffer overflow in fflibwebpgetframe() in libwebpenccommon.c that lets attackers corrupt memory when crthreshold is set. Attackers can supply crafted media that increases resolution mid-stream, causing memcpy() to write pixel data past the stale reference frame and crash applications.